
    Xf{                          d dl Z d dlmZmZ d dlmZmZmZ d dlm	Z	  e j                  e      Z G d dej                        Z G d dej                        Zeeed	Zy)
    N)	GeneratorTuple)	constants
interfacesobjects)
conversionc            
       
   e Zd Zdej                  j
                  fdZdej                  j
                  dedej                  j
                  dedef
dZ	ded	ej                  j
                  defd
Z
deeeef   ddf   fdZy)IMAGE_DOS_HEADERreturnc                    | j                   dk7  rt        d| j                   dd      | j                  j                  }| j	                         }| j
                  j                  |t        j                  z   dz   || j                  j                  | j                  z         }|j                  dk7  rt        d|j                  dd	      |j                  j                  d
k(  r|j                  d      }|S )zCarve out the NT header from this DOS header. This reflects on the
        PE file's Machine type to create a 32- or 64-bit NT header structure.

        Returns:
            <_IMAGE_NT_HEADERS> or <_IMAGE_NT_HEADERS64> instance
        iMZ  ze_magic 04Xz is not a valid DOS signature._IMAGE_NT_HEADERS)
layer_nameoffsetiPE  zNT header signature z is not a validid  _IMAGE_NT_HEADERS64)e_magic
ValueErrorvolr   get_symbol_table_name_contextobjectr   BANGr   e_lfanew	Signature
FileHeaderMachinecast)selfr   symbol_table_name	nt_headers       e/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/pe.pyget_nt_headerzIMAGE_DOS_HEADER.get_nt_header   s     <<6!4<<,,JK  XX((
 668MM((	.1DD!88??T]]2 ) 
	 &(&y':':3&?O 
 ''50!'<=I    sectheaderitemvaluec                 f   | j                   j                  j                  |j                  j                        j
                  }|j                  j                  |j                  j                  z
  }t        j                  |t        |j                  j                        }|d| |z   |||z   d z   }|S )aQ  Replaces a member in an _IMAGE_SECTION_HEADER structure.

        Args:
            sect: the section instance
            header: raw data for the section
            item: the member of the section to replace
            value: new value for the member

        Returns:
            The raw data with the replaced header field
        N)r   symbol_spaceget_typer   	type_namesizer   r   convert_value_to_dataintdata_format)	r   r$   r%   r&   r'   member_sizestartnewvalresults	            r!   replace_header_fieldz%IMAGE_DOS_HEADER.replace_header_field0   s    & mm0099$((:L:LMRR$((//1..uc488;O;OP&(6%+2E2G+HHr#   raw_datar    c                    |j                   j                  j                  j                  | j                  j                  z
  }|j                   j                  j                  j                  }| j
                  j                  j                  |      j                  }	 t        j                  | j                  j                  t        |j                   j                  j                  j                        }|d| |z   |||z   d z   }|S # t        $ r> t        j                  dj!                  | j                  j                               |}Y |S w xY w)a  Fix the _OPTIONAL_HEADER.ImageBase value (which is either an
        unsigned long for 32-bit PE's or unsigned long long for 64-bit PE's) to
        match the address where the PE file was carved out of memory.

        Args:
            raw_data: a bytes object of the PE's data
            nt_header: <_IMAGE_NT_HEADERS> or <_IMAGE_NT_HEADERS64> instance

        Returns:
             <bytes> patched with the correct address
        NzVolatility was unable to fix the image base for the PE file at base address {:#x}. This will cause issues with many static analysis tools if you do not inform the tool of the in-memory load address.)OptionalHeader	ImageBaser   r   r+   r   r)   r*   r,   r   r-   r.   r/   OverflowErrorvollogwarningformat)r   r5   r    image_base_offsetimage_base_typer0   r2   new_pes           r!   fix_image_basezIMAGE_DOS_HEADER.fix_image_baseI   s$     $$..2299DHHOOK 	 $22<<@@JJmm0099/JOO	22i&>&>&H&H&L&L&X&XF ++,,{:<=>    	NN66<fTXX__6M
 F	s   A(D AEENc              #     K   | j                         }| j                  j                  }| j                         }|j                  j
                  }| j                  j                  j                  |t        j                  z   dz         j                  }|j                  j                  }|t        j                  j                  kD  rt        d|       | j                  j                   |   }|j#                  | j                  j$                  |j                  j                  d      }| j'                  ||      }	d|	f |j(                  j*                  |j                  j                  j$                  | j                  j$                  z
  z   }
d}|j-                         D ]b  }|j.                  |kD  rt        d|j.                         |j0                  j2                  |kD  r"t        d|j0                  j2                         |j4                  |kD  rt        d|j4                         |t7        j8                  |j0                  j2                  |d
      }|j#                  |j                  j$                  |      }| j;                  |||j<                  |j.                        }| j;                  |||j4                  |      }| j;                  |||j0                  j2                  |      }|
||z  z   }||f |dz  }e y	w)a$  This method generates the content necessary to reconstruct a PE file
        from memory. It preserves slack space (similar to the old --memory) and
        automatically fixes the ImageBase in the output PE file.

        Returns:
            <tuple> of (<int> offset, <bytes> data)
        _IMAGE_SECTION_HEADERz&The claimed SizeOfImage is too large: T)padr   z%Section VirtualAddress is too large: z"Section VirtualSize is too large: z$Section SizeOfRawData is too large: N)up   )r"   r   r   r   r7   SectionAlignmentr   r)   r*   r   r   r,   SizeOfImagewindowsPE_MAX_EXTRACTION_SIZEr   layersreadr   r@   r   SizeOfOptionalHeaderget_sectionsVirtualAddressMiscVirtualSizeSizeOfRawDatar   roundr4   PointerToRawData)r   r    r   r   section_alignmentsect_header_sizesize_of_image
read_layerr5   
fixed_data
start_addrcounterr$   	sect_size
sectheaderr   s                   r!   reconstructzIMAGE_DOS_HEADER.reconstructp   s     &&(	XX((
 668%44EE==55>>	.1HH

$ 	 "00<< 9,,CCCEm_UVV]]))*5
??HHOOY55AAt # 

 ((9=
m))>>$$((//$((//A

 **, "	D""]2 ;D<O<O;PQ  yy$$}4 89N9N8OP  !!M1 :4;M;M:NO  &,,II))+<	 (__TXX__>NO
!66*d&;&;T=P=P
 "66*d&8&8)
 "66*dii&;&;Y
 $w1A'ABj((1E"	s   H-L0CL)__name__
__module____qualname__r   r   ObjectInterfacer"   bytesr.   r4   r@   r   r   r]    r#   r!   r
   r
      s    z11AA B  00    00	
  
2%%*4*<*<*L*L%	%NKYuS%Z'8$'DE Kr#   r
   c                   L    e Zd Zdeej
                  j                  ddf   fdZy)IMAGE_NT_HEADERSr   Nc              #     K   | j                   j                  }| j                         }| j                  j                  j                  |t        j                  z   dz         j                  }| j                  j                  | j                  j                   j                  z   }t        | j                  j                        D ]>  }|||z  z   }| j                  j                  |t        j                  z   dz   ||       @ yw)z{Iterate through the section headers for this PE file.

        Yields:
            <_IMAGE_SECTION_HEADER> objects
        rB   )r   r   N)r   r   r   r   r)   r*   r   r   r,   r   rL   r7   r   rangeNumberOfSectionsr   )r   r   r   rU   rY   i	sect_addrs          r!   rM   zIMAGE_NT_HEADERS.get_sections   s      XX((
 668==55>>	.1HH

$ 	 OO0043F3F3J3J3Q3QQ 	 t778 	A"a*:&:;I--&&!INN25LL % '  	s   DD)r^   r_   r`   r   r   r   ra   rM   rc   r#   r!   re   re      s'    i
(:(:(J(JDRV(VW r#   re   )_IMAGE_DOS_HEADERr   r   )loggingtypingr   r   volatility3.frameworkr   r   r   volatility3.framework.renderersr   	getLoggerr^   r:   
StructTyper
   re   class_typesrc   r#   r!   <module>rs      sa   
  # @ @ 6			8	$mw)) m`w)) 6 *)+	r#   